ref(security-headers): Remove obsolete HPKP and Expect-CT/Staple UI - #119638
Merged
Conversation
HPKP, Expect-CT, and Expect-Staple are dead in all shipping browsers (HPKP removed from Chrome 72 / Firefox 72; Expect-CT removed from Chromium 107; Expect-Staple never shipped broadly), so their report types can no longer be produced. Remove the frontend support for them: the per-project settings pages and routes, the event-type enums, and the issue/shared/trace rendering branches. CSP and NEL remain untouched. The Generic report component was used exclusively by these three dead types (CSP has its own dedicated renderer), so it is deleted as dead code along with its spec. This is the frontend-only portion; the backend interface/eventtype/ grouping removal and the relay classification change are separate follow-up PRs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
github-actions
Bot
added
the
Scope: Frontend
The PreviewFeature banner was only rendered by the HPKP and Expect-CT settings pages, which were deleted in the previous commit. With no remaining consumers, knip flags it as an unused file, so remove it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
scttcper
approved these changes
Jul 14, 2026
mrduncan
added a commit
that referenced
this pull request
Jul 31, 2026
…ts (#119685) Relay is dropping ingest support for Expect-CT, HPKP, and Expect-Staple security reports in getsentry/relay#6230 — these report types are dead in all shipping browsers (HPKP removed from Chrome 72 / Firefox 72; Expect-CT removed from Chromium 107; Expect-Staple never shipped broadly) and can no longer be produced. This unblocks removing support from Relay, which uses these integration tests. Refs getsentry/relay#6230 Refs #119638 Co-authored-by: Claude <noreply@anthropic.com>
mrduncan
added a commit
that referenced
this pull request
Aug 3, 2026
mrduncan
added a commit
to getsentry/relay
that referenced
this pull request
Aug 4, 2026
Follow-up to 9fbaceb, which stopped accepting these reports at ingest but deliberately kept the protocol surface for a coordinated removal. This does that removal: the EventType variants, the hpkp / expectct / expectstaple fields on the Event schema, and the now-unreachable interface types and their raw parsers. Ingestion behavior is unchanged -- reports are already rejected at the endpoint with an `invalid` outcome. What changes is that an event which an older upstream Relay already classified as one of these types is now forwarded as a `default` event, so it counts against the error quota rather than the security quota. getsentry/sentry#121028 removed the Sentry-side tests that exercised these types through Relay's normalizer, so this no longer breaks Sentry CI. Removing the dead Sentry source (eventtypes, interfaces, grouping strategies) is a follow-up that must land after Sentry bumps its sentry-relay dependency. Refs getsentry/sentry#119638 Refs getsentry/sentry#121028 Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
HPKP, Expect-CT, and Expect-Staple are dead in all shipping browsers (HPKP removed from Chrome 72 / Firefox 72; Expect-CT removed from Chromium 107; Expect-Staple never shipped broadly), so their report types can no longer be produced. Remove the frontend support for them: the per-project settings pages and routes, the event-type enums, and the issue/shared/trace rendering branches. CSP and NEL remain untouched.
The Generic report component was used exclusively by these three dead types (CSP has its own dedicated renderer), so it is deleted as dead code along with its spec.
This is the frontend-only portion; the backend interface/eventtype/ grouping removal and the relay classification change are separate follow-up PRs.
For reference, screenshots before